Insulet

THE SOLUTION

The Omnipod Product Cloud—the AWS-hosted backend serving the connected insulin delivery platform—was running on a deployment process that failed more often than it succeeded. Production deployments took 30+ hours per release, with success rates as low as ~6% in QA. For a platform supporting life-critical insulin therapy, this was not merely an engineering inconvenience; it was a patient-safety and FDA regulatory liability. Manual rollback procedures took hours or never completed, while every release required 100+ manual approval touchpoints with inconsistently documented compliance artifacts, exposing Insulet to FDA inspection risk. Without intervention, Insulet faced delayed delivery of safety patches to patients in the field, growing regulatory exposure, and an inability to reliably scale the platform as the patient population expanded.

Presidio designed and delivered Orca (Orchestrated Release Coordination Architecture), an FDA-compliant deployment orchestration platform purpose-built for the regulatory, scale, and patient-safety requirements of a Class II connected medical device cloud. Orca embeds FDA-canonical validation gates directly into the deployment pipeline, captures MFA-verified electronic signatures at every approval point, and produces a tamper-evident, hash-chained audit trail retained for seven years—turning FDA 21 CFR Part 11 compliance into an automatic byproduct of every release rather than a manual documentation burden. A purpose-designed traffic-management architecture safely shifts traffic across both the medical device telemetry pathway—the persistent encrypted connections between Omnipod 5 devices and the cloud—and the patient-facing application pathway, with automated rollback in under a minute whenever a health-metric breach occurs. The platform is built on AWS Step Functions, Lambda, Fargate, DynamoDB, S3 Glacier Deep Archive with Object Lock, KMS-managed encryption, and AWS Audit Manager.

Outcome

• Release cadence: quarterly → weekly, enabling rapid delivery of safety patches and clinical software updates to patients in the field.

• Deployment lead time: 8–12 weeks → 2–3 weeks; failure rate: ~90% → under 5%; Mean Time To Recovery: days → minutes.

• Manual approval touchpoints per release: 100+ → 10–15 — with stronger, not weaker, underlying audit evidence.

• Every production deployment now captured in an immutable, hash-chained FDA 21 CFR Part 11 audit trail with 7-year compliance-mode retention, producing inspection-ready evidence automatically.

• 13 active AWS Audit Manager assessments covering ~2,643 controls across HIPAA, FDA 21 CFR Part 11, NIST 800-53, CIS, SOC 2, FedRAMP, and GDPR.

• Original engagement extended through 2026, reflecting demonstrated ongoing value.